adding Authorization to Access-Control-Allow-Headers

test/acceptance/ported/attributes.js

@@ -36,7 +36,7 @@ describe('attributes', function() {
     function checkCORSHeaders(res) {
         assert.equal(
             res.headers['access-control-allow-headers'],
-            'X-Requested-With, X-Prototype-Version, X-CSRF-Token'
+            'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Authorization'
         );
         assert.equal(res.headers['access-control-allow-origin'], '*');
     }

test/acceptance/ported/multilayer.js

@@ -25,8 +25,11 @@ describe('multilayer', function() {
     var IMAGE_EQUALS_TOLERANCE_PER_MIL = 20;
 
     function checkCORSHeaders(res) {
-      assert.equal(res.headers['access-control-allow-headers'], 'X-Requested-With, X-Prototype-Version, X-CSRF-Token');
-      assert.equal(res.headers['access-control-allow-origin'], '*');
+        assert.equal(
+            res.headers['access-control-allow-headers'],
+            'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Authorization'
+        );
+        assert.equal(res.headers['access-control-allow-origin'], '*');
     }
 
     // See https://github.com/Vizzuality/Windshaft/issues/70
@@ -1027,7 +1030,8 @@ describe('multilayer', function() {
     //
     ////////////////////////////////////////////////////////////////////
 
-    it("get'ing options on layergroup should return CORS headers",  function(done){
+    it("geting options on layergroup should return CORS headers",  function(done){
+        const allowHeaders = 'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Authorization, Content-Type';
         assert.response(server, {
             url: '/database/windshaft_test/layergroup',
             method: 'OPTIONS'
@@ -1035,7 +1039,7 @@ describe('multilayer', function() {
             status: 200,
             // TODO: use checkCORSHeaders() function
             headers: {
-              'Access-Control-Allow-Headers': 'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Content-Type',
+              'Access-Control-Allow-Headers': allowHeaders,
               'Access-Control-Allow-Origin': '*'
             }
         }, function() { done(); });

test/acceptance/ported/raster.js

@@ -18,8 +18,11 @@ describe('raster', function() {
     });
 
     function checkCORSHeaders(res) {
-      assert.equal(res.headers['access-control-allow-headers'], 'X-Requested-With, X-Prototype-Version, X-CSRF-Token');
-      assert.equal(res.headers['access-control-allow-origin'], '*');
+        assert.equal(
+            res.headers['access-control-allow-headers'],
+            'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Authorization'
+        );
+        assert.equal(res.headers['access-control-allow-origin'], '*');
     }
 
     var IMAGE_EQUALS_TOLERANCE_PER_MIL = 2;

test/acceptance/ported/torque.js

@@ -28,8 +28,11 @@ describe('torque', function() {
     });
 
     function checkCORSHeaders(res) {
-      assert.equal(res.headers['access-control-allow-headers'], 'X-Requested-With, X-Prototype-Version, X-CSRF-Token');
-      assert.equal(res.headers['access-control-allow-origin'], '*');
+        assert.equal(
+            res.headers['access-control-allow-headers'],
+            'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Authorization'
+        );
+        assert.equal(res.headers['access-control-allow-origin'], '*');
     }
 
     it("missing required property from torque layer", function(done) {

test/acceptance/templates.js

@@ -307,16 +307,17 @@ describe('template_api', function() {
           assert.response(server, post_request, {}, function(res) { next(null, res); });
         },
         function testCORS() {
-          assert.response(server, {
-              url: '/api/v1/map/named/acceptance1',
-              method: 'OPTIONS'
-          },{
-              status: 200,
-              headers: {
-                'Access-Control-Allow-Headers': 'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Content-Type',
-                'Access-Control-Allow-Origin': '*'
-              }
-          }, function() { done(); });
+            const allowHeaders = 'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Authorization, Content-Type';
+            assert.response(server, {
+                url: '/api/v1/map/named/acceptance1',
+                method: 'OPTIONS'
+            },{
+                status: 200,
+                headers: {
+                    'Access-Control-Allow-Headers': allowHeaders,
+                    'Access-Control-Allow-Origin': '*'
+                }
+            }, function() { done(); });
       });
     });